UNITED STATES DISTRICT COURT 
EASTERN DISTRICT OF TENNESSEE 
CHATTANOOGA DIVISION 


ECOLAB INC., and NALCO COMPANY, 
LLC d/b/a Nalco Water, an Ecolab Company 
and/or Nalco Water, 

Plaintiffs, 


Vv. 


ANTHONY RIDLEY and CHEMTREAT, 
INC., 


Defendants. 


No. 1:22-cv-00050-TRM-SKL 
Hon. Travis McDonough 


Magistrate Judge Susan K. Lee 


PLAINTIFFS’ MEMORANDUM IN SUPPORT OF ITS MOTION TO STRIKE 
DEFENDANT CHEMTREAT’S REPORT OF ITS COMPUTER EXPERT JAMES 
VAUGHN AND TO PRECLUDE ANTICIPATED TESTIMONY FROM VAUGHN 


FOR FAILURE TO COMPLY WITH FED. R. CIV. P. 26(A) 


Plaintiffs Ecolab, Inc. and Nalco Company, LLC (“Plaintiffs”), by and through counsel, 
hereby move the Court to: (1) strike portions of Defendant ChemTreat’s deficient expert report of 
its computer expert, James Vaughn; and (2) preclude Defendants from offering testimony from 
Vaughn in this case because Vaughn’s report fails to comply with this Court’s Scheduling Order 
and Rule 26(a)(2). Pursuant to the Court’s Amended Scheduling Order at Doc. 99, the Court 
required disclosure of expert testimony in full compliance with Rule 26(a)(2)(B) on or before 
February 17, 2023. As set forth below, Defendant ChemTreat has failed to comply with this 


requirement of the Court’s Order with respect to its computer expert. Plaintiffs request oral 


argument on this Motion. 
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I. INTRODUCTION AND FACTUAL BACKGROUND 
A. Defendant Ridley’s Deposition Testimony Recently Revealed That, Contrary 


To His Sworn Interrogatory Responses, He Continued To Back Up Plaintiffs’ 
Documents To His Personal WD Drive. 


As this Court has recognized, “the record reflects Plaintiffs only recently learned that 
Ridley continued to back up Ecolab/Nalco documents to the [Western Digital] WD Drive as late 
as 2020...during Ridley’s April 17 [2023] deposition.” [Doc. 246, p. 13] As the Court further 
noted, Defendant Ridley’s “interrogatory response [dated July 20, 2022] states that Ridley 
‘believes he backed up the files [to his WD Drive] sometime in 2015 or 2016’...[but] [i]n his 
deposition, however, Ridley testified that he saved Nalco documents to the WD Drive as late as 
2020.” Id. The Court explained that, although Ridley’s “interrogatory response indicat[ed] he last 
backed up Nalco/Ecolab files in 2015/2016 [to his WD Drive]...his very recent deposition 
testimony...states that he backed up these files as late as 2020.” Jd. Ridley has failed to address 
the discrepancy between his interrogatory response and his deposition testimony. Thus, the Court 
found that, “when [Ridley] did realize the 2020 backups to his WD Drive, Ridley did not notify 
Plaintiffs or correct/supplement his prior interrogatory response representing that the 
backups [to the WD Drive] stopped in 2015/2016.” Jd. p. 14-15. (emphasis added) 

B. After Joining ChemTreat, Ridley Used His ChemTreat-Issued Laptop (Which 


ChemTreat Later Wiped And Spoliated) To Access Nalco/Ecolab Documents 
Which He Backed Up and Saved To His WD Drive. 


Based on Ridley’s sworn deposition testimony, it is undisputed that: 

(1) Ridley did not return the full and partial back-ups of his Nalco computer, or 
for that matter any Nalco documents which he saved to his WD Drive, when he departed 
Ecolab on July 1, 2021 and joined ChemTreat. (Second Amended Complaint, 37; Ex. 1, 


56:21-57:9); 
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(2) Instead, after joining ChemTreat, Ridley used his ChemTreat-issued 
computer to connect to his external USB WD Drive. (Doc. 225, Ex. 1, 61:6-17); 

(3) Ridley has further admitted under oath that he used his ChemTreat laptop 
after joining ChemTreat on July 2, 2021 to access Nalco documents located on his WD 
Drive no less than four times on: 

° Two occasions on August of 2021; 
e September of 2021; and 
e January of 2022. (Doc. 225, Ex. 1, 56:21-58:7) 

(4) After ChemTreat was on notice of this lawsuit, which was filed on March 3, 
2022 (Doc. 1), ChemTreat reformatted and forensically wiped the computer which it issued 
to Ridley and which Ridley used to access the Nalco/Ecolab documents which he had 
backed up and saved to his WD Drive. Exhibit A (Vaughn Report, p. 11). 

C. Vaughn’s Expert Report Contains No Mention Of Or Reference To The WD 

Drive Which Ridley Testified That, After Joining ChemTreat, He Connected 


To His ChemTreat Laptop And Used It To Access Nalco/Ecolab Documents 
Saved On The WD Drive. 


Faced with the wiping and spoliation of the ChemTreat laptop which Ridley has admitted 
he used on at least four occasions to access Nalco/Ecolab documents stored on a WD Drive, 
ChemTreat procured the services of computer expert James Vaughn to minimize and deflect 
attention from ChemTreat’s spoliation. The central thesis of Vaughn’s report is that, although the 
ChemTreat laptop which Ridley used has been wiped and no data is recoverable from that laptop, 
ChemTreat’s CrowdStrike log somehow serves as a substitute for information, documents and 
metadata which would have been present on and recoverable from the wiped laptop. Exhibit A, p. 
11 (the laptop which ChemTreat issued to Ridley was “placed with laptops designated for 


reformatting and redeployment by ChemTreat’s IT Department...[and] the profile for Mr. Ridley, 
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along with any documents and forensic artifacts associated to that profile, had been removed [by 
ChemTreat] from the computer during the reformatting process.) 

In his report, Vaughn contends that “the CrowdStrike platform is a powerful tool 
that...maintains a log of all USBs plugged into a particular ChemTreat laptop. CrowdStrike 
also maintains a log of all file names that were accessed by a particular ChemTreat laptop from an 
externally connected USB device.” Exhibit A, p. 11-12 (emphasis added). For added measure, 
Vaughn’s report contends that “CrowdStrike logs provide information about what files were 
accessed from external USB device(s) that have been connected to a particular laptop, as well as 
the date of access, file names, and extensions of those files.” Exhibit A, p. 14. Accordingly, 
Vaughn essentially contends that, although ChemTreat chose to reformat and wipe the laptop 
which it issued to Ridley (and which Ridley used to access Nalco/Ecolab documents on the WD 
Drive), there is no harm/foul because the CrowdStrike log is effectively a substitute for a wiped 
computer: 

Thus, as it pertains to interactions between Mr. Ridley’s first ChemTreat-issued 

laptop [which ChemTreat reformatted/wiped] and external USB devices...the 

CrowdStrike log contains almost all the relevant data that I would have procured 

had I been able to forensically image and analyze Mr. Ridley’s ChemTreat-issued 

laptop prior to formatting. That is, much of the information needed to determine 

insertion of a USB device, and access of these apparently Nalco-related documents 

from a USB device, is available through the CrowdStrike logs. Jd. p. 14 

To further buttress his expert opinion that CrowdStrike maintains a log of all USB devices 
plugged into a ChemTreat laptop, as well as “what files were accessed from [such] external USB 
device(s)”, Vaughn contends that he carefully validated “the accuracy, reliability and completeness 
of the CrowdStrike log of Mr. Ridley’s first ChemTreat-issued laptop” which ChemTreat 
reformatted and wiped. (Exhibit A, p. 39) Having engaged in his purported validation procedures, 
Vaughn’s central conclusion is as follows: 

... can state to a reasonable degree of certainty, based on my expertise as a digital 


forensics examiner, that the CrowdStrike log produced to Ecolab in this litigation 
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accurately and reliably reflects the file names of any files from any external devices 

(such as a USB or external hard drive) that Mr. Ridley interacted with using his 

first ChemTreat-issued laptop. (Exhibit A, p. 40) 

Here, as noted above, Ridley has testified under oath that he connected his USB WD Drive 
to his ChemTreat-issued laptop (which ChemTreat wiped) and accessed Nalco/Ecolab documents 
stored on that WD Drive on no less than four occasions — twice in August of 2021, September of 
2021, and January of 2022. (Doc. 225, Ex. 1, 56:21-58:7) So, according to Vaughn’s lofty 
pronouncements regarding CrowdStrike, the CrowdStrike log should literally show all of 
Ridley’s interactions between the wiped ChemTreat computer and the WD Drive. However, 
Vaughn’s report literally never mentions or references the WD Drive, even though it is 
indisputable that Ridley used his ChemTreat laptop to interact with and access documents 
on that WD Drive. In fact, the words “WD,” “Western Digital,” or some reference similar to those 
terms appears nowhere in Vaughn’s report. Indeed, the Court can peruse Vaughn’s report, attached 
hereto as Exhibit A, and confirm for itself that Vaughn’s report says nothing about the WD Drive. 

D. Having Failed To Address Or Even Reference The WD Drive In His Report, 

Vaughn Suddenly Testified, On The Last Day of Discovery Cutoff, That Two 
Separate And Distinct Hard Drives Referenced In His Report As 


“HarddiskVolume5” And “HarddiskVolume6” Are In Fact A Single USB 
Drive Which Are One And The Same As The WD Drive. 


Vaughn sat for his deposition on April 27, 2023. Faced with questioning about how and 
why his report fails to account for, or even reference, the WD Drive, Vaughn suddenly came up 
with a new and previously undisclosed excuse for this fatal deficiency in his report. Specifically, 
despite having to concede that the terms “WD Drive” or “Western Digital” appeared nowhere in 
his report, Vaughn preposterously testified that his report references two separate devices called 
“HarddiskVolume5” and “HarddiskVolume6”, which Vaughn now contends are a single device 
that is, in fact, the WD Drive. In presenting this false and completely undisclosed narrative, 


Vaughn actually contradicted his own report. 
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In his report dated February 21, 2023, Vaughn wrote that there was some type of interaction 
between Mr. Ridley’s ChemTreat-issued laptop that was wiped and two separate and distinct 
external USB devices, which he identified as “Harddisk VolumeS5” and “Harddisk Volume6”: 


The first five documents listed above appear to have been accessed from a USB 
device that CrowdStrike identified as “Harddisk VolumeS. The last two documents 
listed above appear to have been accessed from another USB device that 
CrowdStrike identified as “HarddiskVolume6.” Exhibit A, p. 13 (emphasis added) 


During his deposition, Vaughn was forced to concede that his report states that Harddisk Volume5 
and Harddisk Volume6 are two different USB devices. 


Q....Let's go back to Page 13. Let me know when you're on Page 13 of 17 your 
report. 

A. Yes, sir. Page 13? Okay. I'm at Page 13. 

Q. Okay. In the middle of the page you wrote, "The first five documents listed 
above appear to have been accessed from a USB drive that CrowdStrike identified 
as hard disk Volume 5. The last two documents listed above appear to have been 
accessed from another USB device that CrowdStrike identified as hard disk Volume 
6." Do you see where you wrote that? 

A. Yes. 

Q. Okay. So in this paragraph, you were stating, essentially, that hard disk Volume 
5 and hard disk Volume 6 are two different USB devices, right? 

A. In this location, I did initially write that. You are correct. And I left that error in 
my report. You are correct. Exhibit B (Deposition of James Vaughn), 129:15- 
130:10. 


Having stated nothing in his report about the WD Drive and having further represented that 
Harddisk VolumeS and Harddisk Volume6 are two entirely different USB drives, Vaughn suddenly 
made a 180-degree turn during his deposition and contended for the first time that 
HarddiskVolume5 and HarddiskVolume6 are actually a single drive that is the same as the WD 
Drive. 

Q. Okay. What's the correction you want to make? 

A. That there's one device, not two. I -- when -- well, there's one device, not two. 

If you want to know more, you'll ask me. 

Q. Okay. Your position is that hard disk Volume 5 and hard disk Volume 6 both 

refer to the WD drive; is that right? 

A. Yes, sir. 


Q....You mean it's a single drive, right? 
A. Yeah. Thank you, sir. Exhibit B, 127:18-128:23 
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Perhaps realizing the glaring deficiency with his own expert report and the fact that his 
testimony was contradicting the report itself, Vaughn falsely and half-heartedly tried to claim that 
some other unidentified section of his report, combined with the CrowdStrike log, somehow 
disclosed that Harddisk VolumeS5 and HarddiskVolume6 are: (1) a single USB device rather than 
two different USB devices; and (2) the same as the WD Drive. Yet, Vaughn could not identify any 
page of his report that even refers to a WD Drive. He also had to concede that neither the 
CrowdStrike log (nor any relevant excerpt thereof) is an exhibit to his report: 


Q....So is there anywhere in your report where you have written that hard disk 
Volume 5 or hard disk Volume 6 are, in fact, the Western Digital drive? 

A. Yes. It may not have been -- 

...Q. Show me -- let -- let's start with a page number. Give me the page number of 
your report where you have disclosed or revealed that hard disk Volume 5 or hard 
disk Volume 6 are the Western Digital drive or the WD drive? 

A. Understood. So the way I documented it in my report was that the CrowdStrike 
report has the makes, models, serial numbers of these devices. And — 


Q. Sir, my question to you was I had asked for a page number. 
A. Right. I'm explaining. 


Q. I'd like -- I'd like to start with your naming the page number where you have 
disclosed, according to you, in some manner, that hard disk Volume 5 or hard disk 
Volume 6 are, in fact, the WD drive. Just give me the page number. That's all I want 
right now. 


THE WITNESS: There are multiple pages that have to be brought together in order 
to properly answer your question. One of the pages -- I'm trying to find it -- one of 
the pages is where I list the header information from the CrowdStrike log and I say 
that it logs -- here we go, sir -- Page 37 — 


Q. Okay. On Page 37, does the -- do the words "WD drive" or "Western Digital 
drive" or "My Book" appear anywhere on Page 37? 

A. No. 

Q. Okay. Is there another page of your report where you contend that you have 
revealed or disclosed in some way that hard disk Volume 5 and hard disk Volume 
6 are the WD drive? 

A. Yes, sir. 

Q. Give me the page number if that's the case. Give me the page number, please. 
A. You have to open the CrowdStrike report, sir. That's my -- 

Q. Is the Crowd -- 

A. That's part of my report. 

Q. Is the CrowdStrike report an exhibit to your expert report? 
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A. It's a material considered. I wouldn't -- I don't believe I made it an exhibit... 
Exhibit B, 130:12-135:18 


Given Vaughn’s brazen attempt to contradict his own report and introduce factual 
assertions which are nowhere to be found in his report or any exhibit thereto, Vaughn’s report and 
his anticipated testimony must be stricken and excluded because Defendant ChemTreat has failed 
to comply with the requirements of Rule 26(a)(2). 

Wt. ARGUMENT 

Fed. R. Civ. P. 26(a)(2)(B) requires that an expert report must contain the following: 

(i) a complete statement of all opinions the witness will express and the basis 

and reasons for them; 

(ii) the data or other information considered by the witness in forming them; 

(iii) | any exhibits that will be used to summarize or support them; 

(iv) the witness's qualifications, including a list of all the publications authored 

in the previous ten years; 

(v) a list of all other cases in which, during the previous four years, the witness 

testified as an expert at trial or by depositions; and 

(vi) astatement of the compensation to be paid for the study and testimony in 

the case. 

The Sixth Circuit has held that “[uJnder Rule 26(a), a ‘report must be complete such that 
opposing counsel is not forced to depose an expert in order to avoid an ambush at trial; and 
moreover the report must be sufficiently complete so as to shorten or decrease the need for expert 
depositions and thus to conserve resources.”’ R C. Olmstead, Inc. v. C.U. Interface, LLC, 606 F.3d 
262, 271 (6th Cir. 2010) (citations omitted). “[A]n expert opinion must ‘set forth facts' and, in 
doing so, outline a line of reasoning arising from a logical foundation.” /d. (citing Brainard v. Am. 


Skandia Life Assur. Corp., 432 F.3d 655, 657 (6th Cir. 2005)). “Expert reports must include ‘how’ 
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and ‘why’ the expert reached a particular result, not merely the expert's conclusory opinions.” /d. 
(citation omitted); see also Hilt v. F.F.C., Inc., 170 F.R.D. 182, 185 (D.Kan.1997) (“The report 
must provide the substantive rationale in detail with respect to the basis and reasons for the 
proffered opinions. It must explain factually why and how the witness has reached them.”); 
Campbell v. McMillin, 83 F.Supp.2d 761, 764-65 (S.D.Miss.2000) (Expert reports must be detailed 
and complete). 

As noted by the commentary, the requirements of paragraph (2)(B) were added because 
“(t]he information disclosed under the former rule in answering interrogatories about the 
‘substance’ of expert testimony was frequently so sketchy and vague that it rarely dispensed with 
the need to depose the expert and often was even of little help in preparing for a deposition of the 
witness.” Fed. R. Civ. P. 26(a)(2)(B) Advisory Committee Notes to the 1993 Amendments. By 
amending the Rule, the Advisory Committee hoped that the detailed reports required by paragraph 
(2)(B) would allow parties to effectively prepare for or possibly avoid deposition of expert 
witnesses. /d (“Since depositions of experts required to prepare a written report may be taken only 
after the report has been served, the length of the deposition of such experts should be reduced, 
and in many cases the report may eliminate the need for a deposition.”); see also Fed. R. Civ. P. 
26(b)(4) Advisory Committee Notes to the 1970 Amendment (“Effective cross-examination of an 
expert witness requires advance preparation. The lawyer even with the help of his own experts 
frequently cannot anticipate the particular approach his adversary's expert will take or the data on 
which he will base his judgment on the stand”). 

Sanctions for violating Fed. R. Civ. P. 26(a)(2)(B) are governed by Fed. R. Civ. P. 37(c)(1), 
which states: “[i]f a party fails to provide information or identify a witness as required by Rule 
26(a) or (e), the party is not allowed to use that information or witness to supply evidence on a 


motion, at a hearing, or at a trial, unless the failure was substantially justified or is harmless.” See 
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also R.C. Olmstead, 606 F.3d at 271. “Federal Rule of Civil Procedure 37(c)(1) requires absolute 
compliance with Rule 26(a), that is, it ‘mandates that a trial court punish a party for discovery 
violations in connection with Rule 26 unless the violation was harmless or is substantially 


999 


justified.” /d. (citations omitted). As the Sixth Circuit has discussed, the commentary to Rule 37 
suggests that “harmless” involves an innocent mistake on the part of the non-disclosing party and 
sufficient knowledge on the part of the other party. Vaughn v. City of Lebanon, 18 F. App'x 252, 
264 (6th Cir. 2001). 5 The burden is on the potentially sanctioned party to prove harmlessness. 
Borg v. Chase Manhattan Bank USA, N.A., 247 F. App'x 627, 636 (6th Cir. 2007) (citation 
omitted). 

Courts in the Sixth Circuit have routinely stricken reports where a party submitted an expert 
report that failed to comply with the mandates of Fed. R. Civ. P. 26(a). R.C. Olmstead, 606 F.3d 
at 271; King v. Ford Motor Co., 209 F.3d 886, 900 (6" Cir. 2000), cert. denied, 531 U.S. 960 
(2000); Sexton v. Uniroyal Chemical Co., Inc., 62 Fed. Appx. 615 (6th Cir. 2003) (same); 
Brainard, 432 F.3d at 664 (excluding expert's opinions that consisted of “broad and dramatic 
language without substance or analysis “‘and reflected an “absence of meaningful analysis or 
reasoning”); 50820 Schoenherr Rd. (FJ) Assocs., LLC v. Fam. Fare, LLC, No. 17-10741, 2017 
WL 6506617, at *3 (E.D. Mich. Dec. 20, 2017) (striking the expert report that failed to include the 
information required by Fed. R. Civ. P. 26(a)(2) - “in particular, the facts and data underlying the 
anticipated expert testimony”). 

Following the Sixth Circuit precedents, this Court should strike Vaughn's expert report 
and exclude his trial testimony for failure to meet the standard set forth by Fed. R. Civ. P. 
26(a)(2)(B). Here, Vaughn’s report does not even remotely comply with the requirements of Rule 
26(a)(2). Rule 26(a)(2) requires that an expert report must contain and disclose, inter alia, a 
complete statement of all opinions the expert will express and the bases and reasons for them; the 
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data or other information considered by the expert informing them; and any exhibits that will be 


used to support them. In addition, under Rule 26(a), “‘a report must be complete such that opposing 


counsel is not forced to depose an expert in order to avoid an ambush at trial...” R C. Olmstead, 


606 F.3d at 271. As addressed above, Vaughn’s report contains the following spurious assertions: 


(1) 


(2) 


(3) 


(4) 


The CrowdStrike platform “contains a log of all USBs plugged into a particular 
ChemTreat laptop.” Exhibit A, p. 11-12 (emphasis added); 

CrowdsStrike logs provide information about what files were accessed from external 
USB drives that have been connected to a particular laptop, as well as the date of 
access, file names, and extensions of those files. Exhibit A, p. 14; 

Vaughn purportedly validated that the CrowdStrike logs provide and contain the 
above-referenced functionality; and 

With respect to “interactions between Mr. Ridley’s first ChemTreat-issued laptop 
[which ChemTreat reformatted/wiped] and external USB devices...the 
CrowdStrike log contains almost all the relevant data that I would have procured 
had I been able to forensically image and analyze Mr. Ridley’s ChemTreat-issued 
laptop prior to formatting. That is, much of the information needed to determine 
insertion of a USB device, and access of these apparently Nalco-related documents 


from a USB device, is available through the CrowdStrike logs.” Exhibit A, p. 14. 


Here, there is simply no way under Rule 26(a)(2) that Vaughn can maintain or be permitted 


to testify that the CrowdStrike report “contains a log of all USBs plugged into a particular 


ChemTreat laptop” or that CrowdStrike shows interactions between such USB devices and the 


computer to which the USB device was connected. It is undisputed and Ridley has testified that, 


after joining ChemTreat, he connected and plugged in his USB WD Drive into his ChemTreat- 


issued laptop (which ChemTreat reformatted/wiped). It is further undisputed that Ridley used his 
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ChemTreat-issued laptop to access Nalco/Ecolab documents saved on his WD Drive. Yet, 
Vaughn’s report does not identify a single interaction between the WD Drive and the ChemTreat 
computer which Ridley used to access Nalco/Ecolab’s documents on the WD Drive. In fact, 
Vaughn’s report quite literally does not reference or mention the WD Drive. 

Stated differently, if, as Vaughn claims, the CrowdStrike contains a log of all USB devices 
plugged into a ChemTreat laptop and further shows what files were accessed from such plugged 
in external USB devices, Vaughn’s report would necessarily have to address the facts that: (1) 
Ridley plugged in the WD Drive into his ChemTreat computer, and (2) identify the files or 
documents that he accessed on the WD Drive. Yet, Vaughn’s report literally says nothing about 
the WD Drive, let alone what files were accessed by Ridley on that WD Drive. Given this obvious 
infirmity with his own report, Vaughn is now suddenly contradicting his own report. 

Specifically, although Vaughn’s_ report states that HarddiskVolume5 and 
HarddiskVolume6 are two different and distinct USB devices, during his deposition Vaughn 
suddenly did an about-face and claimed that his report is incorrect and that Harddisk VolumeS5 and 
Harddisk Volume6 are in fact a single USB device. Needless to say, Vaughn’s report also does not 
set forth any facts explaining or showing that Harddisk VolumeS and Harddisk Volumeé6 are in fact 
the WD Drive, because that would have been contrary to his report’s assertion that 
HarddiskVolumeS5 and HarddiskVolume6 are two different USB devices. Having nothing in his 
report to support his entirely new contention that HarddiskVolumeS5 and HarddiskVolume6 are a 
single USB device that is in fact the WD Drive, Vaughn also tried to argue during his deposition 
that this information is somehow found in some undisclosed portion of the CrowdStrike log, which 
he neither referenced nor explained in his report. In fact, Vaughn grudgingly admitted that neither 
the CrowdStrike report, nor any relevant portion thereof, is an exhibit to his report. Exhibit B, 
130:18 (“...I don’t believe I made it an exhibit...”) Accordingly, his report does not contain the 
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exhibit — e.g., the CrowdStrike report or an excerpt thereof — that Vaughn now contends somehow 
shows that HarddiskVolume5 and HarddiskVolume6 referenced in his report are in fact the WD 
Drive. As a result, Vaughn’s report fails to provide “the data or other information considered by 
[him] informing [his new opinions] which are at odds with his report” or “any exhibits that will be 


used to summarize or support” his new conclusions that contradict his report. Fed. R. Civ. P. 
26(a)(2)(B)(ii), (111). 

Simply put, there are no facts whatsoever in Vaughn’s report that can support the assertions 
that he is now making about HarddiskVolume5, HarddiskVolume6, and the WD Drive. Here, 
given the gravity of Vaughn’s admitted errors and his clear noncompliance with Rule 26(a)(2), the 
Court must strike his report, and Vaughn cannot be permitted to testify regarding the central 
conclusion of his report, which is his assertion that he: 


can state to a reasonable degree of certainty, based on my expertise as a digital 
forensics examiner, that the CrowdStrike log produced to Ecolab in this litigation 
accurately and reliably reflects the file names of any files from any external devices 
(such as a USB or external hard drive) that Mr. Ridley interacted with using his 
first ChemTreat-issued laptop. (Exhibit A, p. 40) 


In addition, the Court must strike and Vaughn must be prohibited from testifying regarding 
the following conclusions which he presents at the end of his report: 


Based on the foregoing and relying upon my more than 20 years of experience and 
expertise as a certified digital forensics examiner, I conclude, based upon the 
analysis of all evidence available to me, that there is no evidence that Mr. Ridley 
stored Ecolab’s confidential information on ChemTreat’s Systems. I further 
conclude that there is no evidence that Mr. Ridley distributed Ecolab’s confidential 
information to other ChemTreat employees using ChemTreat’s Systems. Finally, I 
conclude that Mr. Ridley may have interacted with a very limited set of documents 
that bear file names indicating that they may have originated with Ecolab, although 
he did not upload those documents to ChemTreat’s Systems or use ChemTreat’s 
Systems to distribute them. However, because I do not have access to those 
documents, either from ChemTreat or from Ecolab, I cannot review them to 
determine whether they contain indicia suggesting they actually belong to Ecolab 
or contain Ecolab’s confidential information. Exhibit A, p. 41. 
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Vaughn’s report does not provide the facts necessary to support these opinions or 
conclusions because, although it is undisputed that Ridley plugged in his WD Drive to his 
ChemTreat laptop and accessed Nalco/Ecolab’s documents saved on that WD Drive on at least 
four occasions after he joined ChemTreat, Vaughn’s report is entirely silent about the WD Drive. 
IV. CONCLUSION 

For the above and foregoing reasons, Plaintiffs respectfully request that its Motion to Strike 
Defendant ChemTreat’s Report of its Computer Expert James Vaughn and to Preclude Anticipated 
Testimony from Vaughn for Failure to Comply with Fed. R. Civ. P. 26(A) be granted in its entirety. 

Dated this 25th day of May 2023. 

Respectfully submitted, 


ECOLAB INC. NALCO COMPANY, LLC 
d/b/a Nalco Water, an Ecolab Company 
and/or Nalco Water 


By:  /s/Pavneet Singh Uppal 
J. Gregory Grisham (TN BPR#013810) 
FISHER & PHILLIPS LLP 
1715 Aaron Brenner Drive, Suite 312 
Memphis, Tennessee 38120 
Telephone: 901.526.0431 
Fax: 901.526.8183 


ggrisham@fisherphillips.com 


David J. Walton 

(pro hac vice) 

FISHER & PHILLIPS LLP 
Two Logan Square, 12th Floor 
100 N. 18th Street 
Philadelphia, PA 19103 
Telephone: 610.230.6015 
Fax: 610.230.2151 
dwalton@fisherphillips.com 


Edward G. Winsman 

(pro hac vice) 

FISHER & PHILLIPS LLP 
Two Logan Square, 12th Floor 
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100 N. 18th Street 
Philadelphia, PA 19103 
Telephone: 610.230.2142 
Fax: 610.230.2151 
ewinsman@fisherphillips.com 


Pavneet Singh Uppal 

(pro hac vice) 

FISHER & PHILLIPS LLP 

3200 North Central Avenue, Suite 1550 
Phoenix, AZ 85012 

Telephone: 602.281.3410 

Fax: 602.281.3401 
puppal@fisherphillips.com 
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